Privileged account recovery
Use this only when the normal authenticator and recovery codes are unavailable.
This high-severity path revokes active sessions and consumes one offline recovery credential.
